CVE-2020-8297

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference IDOR vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user...

Design/Logic Flaw

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference IDOR vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user...

Nextcloud Deck 安全漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Deck before 1.0.2 that stems from an insecure direct object reference IDOR. An attacker could exploit the...

PT-2021-17066 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: The issue allows an attacker to see all users in the CMS using the API endpoint "/users/id". For each call, they get in response a lot of information about the user, such as email address, firs...

Red Hat Keycloak Input Validation Error Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak has an input validation error vulnerability that arises from not properly encoding user-supplied data fields and using...

CVE-2020-35734

Batflat CMS 1.3.6 is vulnerable to authenticated code injection leading to Remote Code Execution via input fields on the Users tab. Exploitation requires login to the admin panel and editing another user’s data (e.g., username or display name). Affected product/version: Batflat 1.3.6; vendor note...

TikTok: Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)

An unclaimed Amazon S3 bucket which no longer used for any TikTok applications and did not host any user data could have allowed a takeover on a musical.ly subdomain. We thank @daik0n for reporting this to our team...

CVE-2021-22663

Cscape All versions prior to 9.90 SP3.5 lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process...

Linux-Chrome-Recon - An Information Gathering Tool Used To Enumerate All Possible Data About An User From Google-Chrome Browser From Any Linux Distribution

"linux-chrome-recon" is a Information gathering tool used to enumerate all possible data about an user from Google-Chrome browser from any Linux distribution Intro 1.Loots possible data from Google-Chrome 2.Launches HTTP Server on /tmp directory Usefull 3.Simple script to receive data from...

Hackers leak millions of Airtel India user data with Aadhaar numbers

By Waqas Airtel India claims it did not suffer a data breach and there are inaccuracies in claims made by the hackers. This is a post from HackRead.com Read the original post: Hackers leak millions of Airtel India user data with Aadhaar numbers...

PT-2021-2443

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 8.5.0 through 8.5.61 Apache Tomcat versions 9.0.0.M1 through 9.0.41 Apache Tomcat versions 10.0.0-M1 through 10.0.0 Description: The issue is related to the implementation of the HTTP/2 protocol in Apache Tomcat, which...

Mitel Networks MiCollab License Issue Vulnerability

Mitel Networks MiCollab is a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. A security vulnerability previously existed in Mitel Networks MiCollab version 9.2, which stemmed from a library index page in...

CVE-2020-35547

A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access view and modify to user data...

CVE-2021-3176

The chat window of the Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view...

CVE-2020-35547

A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access view and modify to user data...

Mitel BusinessCTI Enterprise (MBC-E) Client Input Validation Error Vulnerability

Mitel Networks BusinessCTI Enterprise is an employee communication software for attendance management and instant messaging from Mitel Networks Canada. Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.15 and 7.x before 7.1.2 An input validation error vulnerability exists, which...

Mitel Networks MiCollab 授权问题漏洞

Mitel Networks MiCollab is a mobile application from Mitel Networks Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. A security vulnerability previously existed in Mitel Networks MiCollab version 9.2, which stemmed from a library index page in...

Why Data Privacy Day matters

Our Lock and Code special episode on Data Privacy Day, featuring guests from Mozilla, DuckDuckGo, and Electronic Frontier Foundation can be listened to here. Today, January 28, is Data Privacy Day, the annual, multinational event in which governments, companies, and schools can inform the public...

TikTok Flaw Lay Bare Phone Numbers, User IDs For Phishing Attacks

A vulnerability in the popular TikTok short-form video-sharing platform could have allowed attackers to easily compile users’ phone numbers, unique user IDs and other data ripe for phishing attacks. TikTok, owned by ByteDance, has more than 800 million active users worldwide. The vulnerability,...

The vulnerability of the command-line interface of the Cisco Connected Mobile Experiences software allows a hacker to obtain information about users of the CMX system.

The vulnerability of the command-line interface of the Cisco Connected Mobile Experiences software is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to gain access and disclose information about users of the CMX system...